Privacy Policy

Stublet is a subletting platform operated in Israel. We are the controller of the database that stores your information and are responsible for how it is processed.

This policy applies to the Stublet mobile app (iOS and Android) and the website at stublet.app. It explains what we collect, why, with whom we share it, and what rights you have under Israel's Protection of Privacy Law, 5741-1981 (including Amendment 13, effective 14 August 2025).

Privacy contact: [email protected].

Information you give us directly:

• Account details: name, phone number, and/or email (depending on the sign-in method you chose)
• Profile: optional profile photo and short bio
• Listings: title, description, photos, property type, city, neighborhood, optional street address you provide, availability dates, price and deposit amount (display only - Stublet does not process payments)
• Chat messages and attachments
• Booking requests and reports you file

Information collected automatically while you use the app:

• Device identifier and push token (FCM) so we can deliver notifications
• Platform, app version, OS version, system language, last-login timestamp
• Aggregate analytics events (e.g. "listing viewed", "search performed") - we do not intentionally include phone numbers, emails, names, or text you typed. Events may be linked to an internal account or installation identifier. PostHog and Firebase Analytics receive network requests and may observe the source IP needed to deliver them; client-side filtering does not make a promise that a provider never sees network metadata. Google Analytics on the website is subject to the same limitation
• Session Replay (masked screen recording) is currently disabled in the app and on the website. If we enable it in the future, this policy will be updated first to describe its consent, masking and retention terms
• Crash and error reports, after redacting sensitive fields (passwords, OTPs, tokens, phone numbers and emails never enter the logs)
• The IP address a request reaches our server from. We read it at request time to rate-limit traffic, to prevent abuse of verification-code sending (for example a flood of codes to dozens of different numbers from one source), and to spot suspicious access attempts against the admin endpoints. It is not stored on your profile and does not enter your usage history: it lives in short-lived counters that expire on their own, and in the server logs

Your device contacts (entirely optional, and only if you allow it):

If you choose "Connect contacts", we first explain what happens, and only after you agree does the operating system ask for permission to read your address book. Connecting requires a verified phone number on the account.

What leaves your phone: each number is normalized to the international format and put through a SHA-256 hash on the device itself. Only the hashes leave the phone, in batches of up to 1,000 per request. The names, addresses and other details you saved are never sent to us, and the server rejects any request that carries anything other than the hashes.

What we store: the server mixes each hash with a secret value that exists only on our servers (a "pepper") and stores only the result, a matching code, together with your account. This includes numbers of people who are not on Stublet yet. We do not store the phone numbers themselves or any names. Without the secret value the codes are very hard to compare against a list of numbers, but we still treat them as coded personal data, not anonymous data. We also store a matching code of your own phone number, so that people who saved you can find you.

Updates and automatic deletion: while the connection is on, the app updates the list at most once a day when you open it. If your address book changed it uploads it again; if not, it only tells the server you are still using it. The saved list is deleted automatically 365 days after the last update or check-in, or immediately when you delete it yourself.

What connecting shows you:

• Which of your contacts are already on Stublet, with the name and photo from their Stublet profile. Nobody starts following anybody on their own: a follow only happens when you tap
• "People you may know": people whose number you saved, and people who also connected their contacts and share at least 2 saved numbers with you of people who are not on Stublet yet. A number saved by a very large number of accounts is never used for this
• Mutual acquaintances: when someone is suggested because of shared numbers, or when one of your contacts follows the hosts of a listing (or they follow your contact), we show it with the name as you saved it in your phone, and sometimes the number of shared contacts. The server sends your phone only a code, never a name or a number; the name comes from your own address book
• A notice when one of your contacts joins Stublet: a row under "Recently joined" (the last 30 days) and a push notification. On the lock screen the notification does not include the name unless you turned on "detailed notifications". You can mute it with the "new followers" switch

What others see through their own connection, even if you never connected yours:

• Anyone who saved your number and connected their contacts sees you (name and profile photo) in their contacts on Stublet and in suggestions. Your number is never shown to anyone
• When you verify your phone number, everyone who saved it and connected their contacts gets a one-time notice that you joined, as described above. You are not notified about it
• Someone who saved your number may see, next to a listing, that you follow its hosts or that they follow you
• If you connected your contacts too, someone who shares at least 2 saved numbers with you of people not on Stublet yet may see you in suggestions, together with the name they themselves saved for one of those numbers, or the count of shared numbers. From that they may work out that you saved the same person

Names on your phone: the names you saved stay on your phone, in an encrypted store, and are used only to show you your own labels. They are deleted from your phone when you sign out or delete the saved contacts. Names shown for connections through follows come from the other person's Stublet profile.

You are in control, in Settings under "Privacy and contacts":

• "Delete saved contacts" deletes the list from the server and the names from your phone immediately, and turns off "See mutual acquaintances through contacts". Suggestions in "People you may know" that came from your contacts disappear immediately as well
• "Disconnect contacts" stops the daily update, but what was already saved stays until you delete it or it is deleted automatically
• Separate switches, all on by default: "Appear as a mutual acquaintance", "People who saved my number can find me", "Appear in 'People you may know'", "Tell my contacts when I joined" and "See mutual acquaintances through contacts". To stop us announcing that you joined, turn off "Tell my contacts when I joined"
• You can revoke contacts permission at any moment in your device settings. Without it the daily update stops, and the saved list is deleted automatically unless you delete it first. You may decline, and the rest of the app works without connecting

People who do not use Stublet: we never contact people whose number reached us only through a user's address book, never message them, never sell their number and never use it for advertising. Anyone who wants their number to stop being used for matching can ask, without an account, at stublet.app/en/contact-removal: we send a verification code by SMS to the number, and once it is confirmed, matching stops immediately, the matching code is removed from every saved list shortly after, and it is kept on a block list so it is not added again. The full details are on that page.

Earlier app versions: in earlier versions, or when the saved connection is unavailable, "find friends" runs a one-time comparison: the hashes serve that one request only and are not stored.

Your device location (optional, and only if you allow it):

Maps in the app can show a dot marking where you are, so you can see where listings sit relative to you. For that the operating system asks you for location permission. The position is read by the map component on the device itself: it is not sent to our servers, not stored by us, and does not affect how results are ranked or filtered. If you decline, the maps simply render without that dot.

Client-side storage:

• In the app: a local store on your device (MMKV) that keeps your preferences, listing drafts, cached content, and a Terms/Privacy receipt containing the accepted document versions and timestamp; your sign-in session is kept on the device by Firebase Authentication
• On stublet.app: the Google Analytics measurement cookies, a localStorage key called "stublet-theme", a localStorage key used by our second measurement tool PostHog (in the form "ph_..._posthog"), and a sessionStorage key called "stublet-campaign". Each one is set out in full - its name, what it does, how long it lives, and how to opt out - in the "Cookies and similar technologies" section further down this page

We do not request date of birth, government ID numbers, payment details, or financial information for registration, and we do not process sublet payments. Users can still include such information in messages, attachments, listings, reports or support requests; do not upload information that is not needed.

Providing this information is not legally required. Without it we cannot provide the service (e.g. without a phone number you cannot register and publish a listing).

This is the complete account of what is stored in your browser when you visit stublet.app. We do not show a cookie consent dialog, which makes this list the notice itself - so it has to be complete and accurate.

Measurement cookies (Google Analytics 4), loaded on every page of the site:

• "_ga" - distinguishes one visitor from another. Two-year lifetime by Google's default
• "_ga_" followed by the site's measurement id (in the form "_ga_XXXXXXXXXX") - holds the state of the current visit, so a session has a start and an end. Also a two-year default lifetime

Both serve a single purpose: knowing, in aggregate, how many people reach the site, which pages they read, and where they came from. They do not carry your name, they are not linked to your Stublet account, and they are not used for advertising.

Local browser storage, which is not a cookie and is never sent to a server:

• "stublet-theme" in localStorage - remembers whether you chose dark or light mode. It stays until you clear the site's data in your browser
• "stublet-campaign" in sessionStorage - if you arrived through a marketing link, it holds the campaign parameters contained in that link (source, medium, campaign name, keyword, and creative variant), so we can tell which campaign brought you even if you move between pages before downloading. It is cleared the moment you close the tab, and it holds no personal information about you, only the campaign words we wrote into the link ourselves
• "ph_" followed by our PostHog project key, then "_posthog", in localStorage - our second measurement tool, PostHog, which counts page views and downloads alongside Google Analytics. It holds a random identifier for this browser plus the state of the current visit. It is deliberately configured to use local storage and NO cookies at all, it creates no profile for an anonymous visitor, it records no session replay on this site, and it is not linked to your Stublet account. It stays until you clear the site's data in your browser

Separately, the links to the app stores carry campaign parameters, so we can tell which page or which campaign a download came from, without knowing who downloaded.

There are no advertising cookies and no advertising pixels on this site. We load no ad-network code at all - not Meta's, not TikTok's, not Google Ads' - and we build no retargeting audiences. If that ever changes, this policy will be updated before the change, not after it.

How to opt out of measurement:

• Your browser settings let you block or delete cookies, either for every site or for stublet.app alone. Blocking them does not affect your use of the site
• Google publishes an official browser add-on that switches Google Analytics off on every site you visit: tools.google.com
• If your browser blocks third-party scripts, or you use an ad blocker, the measurement code simply never loads and no measurement happens at all

Visitors from Europe and the UK: across the European Economic Area, the United Kingdom, and Switzerland we set Google Consent Mode to denied by default. gtag therefore runs cookieless there: it writes no "_ga" and no session cookie at all, and measurement is reduced to an aggregate count. This happens on its own, with nothing for you to click. PostHog sets no cookie anywhere in the world, and in these same regions it stores nothing on your device at all: it is switched to in-memory only, so the "ph_..._posthog" key described above is never written, and the count of a visit ends when you close the page. This too happens on its own, with nothing for you to click.

Your information is used only for:

• Operating the service: sign-in, showing relevant listings, messaging, and booking requests
• Showing social context and degrees of separation so you can decide who to engage with
• Connecting contacts, only if you agreed: showing you which contacts are already here, suggesting people you may know, showing mutual acquaintances (including next to listings), and telling you when a contact joins
• Preventing abuse of contact connecting, such as attempts to check many numbers: rate limits and an access log (see "Security")
• Ranking the discovery feed by social trust and your preferences (recent searches, saved listings, dismissed listings)
• Understanding product usage, improving the experience, and diagnosing issues - via aggregate analytics and crash/error diagnostics
• Identity verification through Firebase Authentication (phone, email, Google, Apple, Facebook)
• Safety and fraud prevention: detecting abuse, suspending abusive accounts, reviewing reports
• Push notifications for new messages, followers, and listing updates
• Responding to support requests
• Featuring a listing on Stublet's own social media accounts (Instagram, TikTok, Facebook, YouTube), only if you explicitly allowed it for that listing. The video or post shows photos, neighborhood, price and dates, and never your name, face, phone number, street or exact location. This permission is off by default, you can withdraw it at any time from the listing's manage menu, and it ends on its own when the listing stops being public, is deleted or expires. After you withdraw it we remove the content from our accounts; copies others already saved are outside our control.

We do NOT use your information for third-party advertising. We do NOT sell your information.

With other users: per each listing's privacy setting (public / followers / friends-of-friends / three degrees) - your name, profile photo, the listing details, and the address if you entered one. Your chat messages are visible only to the other person in the conversation. Message attachments are stored under an account-scoped object key. Where our private-media gate is enabled, they are delivered to conversation participants through short-lived download links; attachments uploaded before that gate was enabled, or while it is not enabled, can be opened by anyone who holds their link. Do not send documents or images you would not want a recipient to be able to forward.

With a host when you send a booking request: your name and the requested dates become visible to the host inside the app. The push notification the host receives includes the listing title, the date range, and the number of nights; your name appears in the notification itself only if the host has turned on their "detailed notifications" setting. The notification's content may appear on the host's lock screen, according to the notification settings on their device. No price is ever included in the notification.

With a mutual acquaintance when you ask about hosts: on a listing page we may offer to let you ask a mutual acquaintance, a contact from your address book or someone in your Stublet network, whether they know the hosts. The system picks the acquaintance from existing connections. If you send a question, they receive it in your shared general chat, with your name, the text you wrote, the hosts' name and photo, and a listing preview only if they can see that listing themselves. In other words, a third person learns that you asked about the hosts. Their push notification carries no names on the lock screen unless they turned on "detailed notifications". The hosts are not notified and never see the question. The answer comes back to you with the acquaintance's name. Questions and answers are kept until one of the accounts involved is deleted.

Invite and share links (stublet.app/i/...): when you create a personal invite link or a link to share a listing, we store who created it and the first signed-in account that opens it (not you, and for a listing link not the hosts either). Whoever opens an invite link sees your name, photo and friend count. The first person to open a listing link you sent them sees you at the top of their "People you may know" for 30 days. We never show you who opened your link, and opening a link never creates a follow. A link is valid for 14 days and deleted 30 days after it expires.

As a host, when booking-request SMS notices are enabled, we may text you about new requests you have not answered. Several requests may be grouped into one SMS with a request count and a link to view them in the app; a single request gets a direct link. The SMS may include your listing title and, for a single request, the dates and number of nights. It excludes the requester's name, message content, and price. You can turn these notices off in Settings. ActiveTrail sends the SMS.

With our team when a report is filed: when a user reports a listing, profile, or message, our safety team may review the relevant content to handle the report. We do not routinely monitor messages.

With service providers (subprocessors): we use leading third-party providers that process data on our behalf, under a data processing agreement, for the services we ask of them:

• Google Firebase - Authentication (Auth), product analytics (Analytics), crash reports (Crashlytics), and push notifications (FCM)
• ActiveTrail - the Israeli SMS carrier that delivers your one-time sign-in and phone-verification code, the verification code for someone asking to remove their number on the number-removal page, and, for hosts, the booking-request SMS notice (see above). It receives the phone number to send to and the message body only, and nothing else about you
• Twilio (Verify) - an international SMS provider, which likewise receives only the phone number. It carries non-Israeli numbers, WhatsApp verification if you choose that channel, and acts as the fallback when a send through the Israeli carrier fails
• Sentry - backend and mobile error monitoring
• PostHog - product analytics and conversion funnels. Session Replay is currently disabled. Data is stored according to the configured PostHog project and vendor terms
• Cloudflare R2 - profile/listing photos and private message attachments
• MongoDB Atlas - primary database, including the social graph (who follows whom, who has blocked whom) and the coded contact lists
• Apple, Google, Meta - the OAuth identity provider you chose
• Google Maps API and MapLibre - address search and map rendering. On iOS, address search and turning coordinates back into an address go through Apple's mapping service rather than Google's, and what is sent is the address string or the property's coordinates, not your own location
• Expo (EAS Update) - the app's code-update service. Every time the app is launched afresh it asks Expo whether a newer code version exists, and that request carries the platform and device type, the app version and runtime version, an install identifier generated by Expo, and the IP address you connected from. The request does not carry your Stublet account identity
• Railway - backend hosting, and within the same environment a managed Redis instance. Redis holds short-lived counters for request rate limiting and for preventing abuse of verification-code sending, some of them keyed by the IP address the request came from

Which carrier sends an SMS is a server setting. In the configuration where we manage the code lifecycle ourselves, a message to an Israeli number goes through ActiveTrail and everything else goes through Twilio; in an alternative configuration the whole verification runs at Twilio; and in the default configuration the message is sent by Firebase. Under all three, the only detail about you the carrier receives is the phone number.

Some of these providers operate globally, so your data may be processed or stored in the US, in Europe, or in other regions. We rely on approved transfer mechanisms: EU Standard Contractual Clauses (SCCs) or a provider-specific DPA.

For a detailed breakdown of the processing chain for specific data, contact us at [email protected].

With authorities: only as required by law or by an order from a competent authority.

We do not sell your data. Ever.

Under Israel's Protection of Privacy Law, 5741-1981 (including Amendment 13, 2025), you have:

• Right of access: receive a description of the information we hold about you
• Right to rectification: update inaccurate or out-of-date information
• Right to deletion: request deletion of your account and the personal data tied to it (full details on the "Account & Data Deletion" page)
• Right to restrict processing: ask us to stop processing your data for specific purposes

How to exercise: email [email protected] with the details of your request. We will respond within the period required by applicable law. We respond in Hebrew, English, or Arabic, per your choice.

Managing push notifications: under Settings > Notifications in the app you can independently toggle three notification types: new messages, new followers, and listing updates. Alongside them sits a "detailed notifications" switch, which decides whether the sender name and message text appear in the notification body on your lock screen; it is off by default.

Your account also stores a separate preference marker for marketing content. It is off by default for every user, and it cannot currently be changed from inside the app because no Settings switch is wired to it. If we add such a switch, or if we begin sending marketing content, we will update this policy before the change rather than after it.

Managing contacts and privacy: in Settings under "Privacy and contacts" you can delete your saved contacts, disconnect the daily update, and decide separately whether you appear as a mutual acquaintance, whether people who saved your number can find you, whether you appear in suggestions, whether we tell your contacts you joined, and whether we show you mutual acquaintances through your contacts. People who do not use Stublet can ask that their number stop being used for matching at stublet.app/en/contact-removal.

If you are not satisfied with how we handled your request, you can contact the Privacy Protection Authority at the Israel Ministry of Justice, 22 Kanfei Nesharim St., Jerusalem.

As long as your account is active we keep your data so you can keep using the service.

After account deletion (full details on the "Account & Data Deletion" page):

• Identifying fields (name, phone, email, profile photo) are nulled immediately
• Your listings move to inactive and the host snapshot on each one is nulled
• Your social-graph relationships, your photos in storage, and your push tokens are deleted
• Active sessions are terminated
• Your saved contact list, host questions you asked or were asked, your suggestions and dismissals, contact-join records, and links you sent or opened are deleted

What may remain: booking requests you sent or received (without your identifying information), reports filed against you (for safety reasons), aggregate analytics events that don't identify you personally, and data subject to an active legal hold.

Some data is deleted on its own even while your account is active: the saved contact list 365 days after its last update, and invite and share links 30 days after they expire. The contacts access log (see "Security") is kept for 24 months, including after account deletion, with the internal account identifier only. A number removed on the number-removal page stays on the block list as a matching code, so it is not added again.

Our service providers keep the data they hold under their own policies, and those periods differ from one another. There is no single figure:

• Firebase Analytics, Crashlytics, Sentry and PostHog: retain data according to the configured project and vendor retention settings. We send deletion requests where the provider supports them
• Cloudflare R2: we request deletion of account media when the account is deleted; provider backups and replicas may persist for the provider's documented backup period

The same provider caveats appear on the "Account & Data Deletion" page. If you ever find the two pages disagreeing, write to us.

We apply standard technical and organizational safeguards:

• HTTPS / TLS for all traffic between the app and the servers
• Encryption at rest at every storage provider (MongoDB Atlas, Cloudflare R2)
• Access keys scoped to backend servers - no key reaches a client device
• Redaction of sensitive fields (passwords, OTPs, tokens, phone numbers, emails) before they enter the server logs
• An access log for contact connecting, to detect abuse: each action records the internal account identifier, the kind of action, how many items it involved, whether it succeeded, the app-authenticity check result, and the time. It never holds phone numbers, matching codes, names or IP addresses, and it is deleted automatically after 24 months. Each account can also update its contact list once per day
• Automatic session revocation on account deletion

That said, no system is 100% secure. Keep your sign-in details safe and contact us immediately if you suspect your account has been compromised.

Stublet is for users 18 and over. Subletting requires legal capacity to enter contracts.

We do not collect date of birth. At sign-up you confirm you are 18 or older (Section 1 of the Terms of Service). If we identify a user under 18, we delete the account immediately.

Parents who discover that a child opened an account by mistake: email [email protected] and we will expedite deletion. For the full child-safety policy, including zero tolerance for CSAE, see the "Safety & Moderation" page.

For any privacy question, request, or complaint:

Email: [email protected]

Policy updates: we may update this policy from time to time. A material update (new data categories, a new service provider, expanded uses) is surfaced in the app before you continue using it. A cosmetic update is reflected by the "last updated" date at the top of the page and the revision number beside it. If you want to know what changed between two revisions, or to receive the text that was in force on a particular date, write to [email protected] and we will send it to you.

Israeli regulator: Privacy Protection Authority, Ministry of Justice, 22 Kanfei Nesharim St., Jerusalem.